@vizamodo/aws-sts-core 0.2.19 → 0.2.34

package/dist/sts/issue.js

@@ -3,17 +3,44 @@ import { buildCanonicalRequest } from "../sigv4/canonical";
 import { buildStringToSign } from "../sigv4/string-to-sign";
 import { signStringToSign } from "./signer";
 import { InternalError } from "./errors";
+// ---- constants (cleaner configuration, no runtime cost) ----
+const ALGORITHM = "AWS4-X509-ECDSA-SHA256";
+const SERVICE = "rolesanywhere";
+const PATH = "/sessions";
+const PROFILE_TTL = {
+    Runtime: 90 * 60,
+    ConsoleReadOnly: 12 * 60 * 60,
+    ConsoleViewOnlyProd: 12 * 60 * 60,
+    BillingReadOnly: 2 * 60 * 60,
+    BillingAdmin: 2 * 60 * 60,
+    BillingAccountant: 2 * 60 * 60,
+};
+const DEFAULT_TTL = 2 * 60 * 60;
 // ---- isolate-level cached signing material ----
 let cachedSigningKey = null;
 let cachedCertBase64 = null;
+let cachedPrivateKeyBase64 = null;
+// ---- shared encoder + canonical request hash cache ----
+const textEncoder = new TextEncoder();
+let lastCanonicalRequestKey = null;
+let lastCanonicalRequest = null;
+let lastCanonicalRequestHash = null;
+let lastBody = null;
+let lastPayloadHash = null;
+let lastBaseHeadersKey = null;
+let lastCanonicalHeaders = null;
+let lastSignedHeaders = null;
 async function getSigningMaterial(input) {
-    if (cachedSigningKey && cachedCertBase64) {
+    if (cachedSigningKey &&
+        cachedCertBase64 === input.certBase64 &&
+        cachedPrivateKeyBase64 === input.privateKeyPkcs8Base64) {
         return { signingKey: cachedSigningKey, certBase64: cachedCertBase64 };
     }
     try {
-        cachedCertBase64 = input.certBase64;
         const keyBuffer = base64ToArrayBuffer(input.privateKeyPkcs8Base64);
         cachedSigningKey = await crypto.subtle.importKey("pkcs8", keyBuffer, { name: "ECDSA", namedCurve: "P-256" }, false, ["sign"]);
+        cachedCertBase64 = input.certBase64;
+        cachedPrivateKeyBase64 = input.privateKeyPkcs8Base64;
         return { signingKey: cachedSigningKey, certBase64: cachedCertBase64 };
     }
     catch {
@@ -21,22 +48,7 @@ async function getSigningMaterial(input) {
     }
 }
 function resolveSessionTtlByProfile(profile) {
-    switch (profile) {
-        // Runtime
-        case "Runtime":
-            return 90 * 60; // 90 minutes
-        // Console profiles
-        case "ConsoleReadOnly":
-        case "ConsoleViewOnlyProd":
-            return 12 * 60 * 60; // 12 hours
-        // Billing profiles
-        case "BillingReadOnly":
-        case "BillingAdmin":
-        case "BillingAccountant":
-            return 2 * 60 * 60; // 2 hours
-        default:
-            return 2 * 60 * 60; // fail-safe
-    }
+    return PROFILE_TTL[profile] ?? DEFAULT_TTL;
 }
 /**
  * Issue short-lived AWS credentials via Roles Anywhere.
@@ -45,23 +57,19 @@ export async function issueAwsCredentials(input) {
     const { roleArn, profileArn, trustAnchorArn, region, certBase64, privateKeyPkcs8Base64, profile, } = input;
     // 1. Kiểm tra đầu vào & Fix TTL an toàn
     const sessionTtl = resolveSessionTtlByProfile(profile);
-    console.log("profile:", profile, "sessionTtl:", sessionTtl);
     const { signingKey } = await getSigningMaterial({ certBase64, privateKeyPkcs8Base64 });
     // 2. Setup constants
-    const host = `rolesanywhere.${region}.amazonaws.com`;
-    const path = "/sessions";
+    const host = `${SERVICE}.${region}.amazonaws.com`;
+    const path = PATH;
     const now = new Date();
-    const amzDate = now.toISOString().replace(/\.\d{3}Z$/, "Z").replace(/[:-]/g, "");
+    const amzDate = now.toISOString().replace(/[:-]|\.\d{3}/g, "");
     const dateStamp = amzDate.slice(0, 8);
-    const service = "rolesanywhere";
+    const service = SERVICE;
     // 3. Chuẩn bị Body & Cert
     const body = JSON.stringify({ trustAnchorArn, profileArn, roleArn, durationSeconds: sessionTtl });
-    const payloadHash = await sha256Hex(body);
+    const payloadHash = await getPayloadHash(body);
     // --- REFACTOR: Làm sạch chứng chỉ chặt chẽ ---
-    const normalizedCert = certBase64
-        .replace(/-----BEGIN CERTIFICATE-----/g, "")
-        .replace(/-----END CERTIFICATE-----/g, "")
-        .replace(/\s+/g, "");
+    const normalizedCert = normalizeCert(certBase64);
     // --- REFACTOR: Parser ASN.1 an toàn để lấy Serial Number (DECIMAL) ---
     // --- MINIMAL DER WALK: extract serial number ---
     let certSerialDec;
@@ -98,7 +106,11 @@ export async function issueAwsCredentials(input) {
         if (der[offset++] !== 0x02)
             throw new Error("bad serial tag");
         const serialLen = readLen();
-        const serial = der.slice(offset, offset + serialLen);
+        let serial = der.slice(offset, offset + serialLen);
+        // strip leading 0x00 padding if present (DER signed integer rule)
+        if (serial.length > 1 && serial[0] === 0x00) {
+            serial = serial.slice(1);
+        }
         certSerialDec = BigInt("0x" +
             Array.from(serial)
                 .map(b => b.toString(16).padStart(2, "0"))
@@ -115,9 +127,9 @@ export async function issueAwsCredentials(input) {
         "x-amz-date": amzDate,
         "x-amz-x509": normalizedCert,
     };
-    const { canonicalHeaders, signedHeaders } = canonicalizeHeaders(baseHeaders);
+    const { canonicalHeaders, signedHeaders } = getCanonicalizedHeaders(baseHeaders);
     const credentialScope = `${dateStamp}/${region}/${service}/aws4_request`;
-    const canonicalRequest = buildCanonicalRequest({
+    const canonicalRequest = getCanonicalRequest({
         method: "POST",
         canonicalUri: path,
         query: "",
@@ -125,11 +137,12 @@ export async function issueAwsCredentials(input) {
         signedHeaders,
         payloadHash,
     });
+    const canonicalRequestHash = await getCanonicalRequestHash(canonicalRequest);
     const stringToSign = buildStringToSign({
-        algorithm: "AWS4-X509-ECDSA-SHA256",
+        algorithm: ALGORITHM,
         amzDate,
         credentialScope,
-        canonicalRequestHash: await sha256Hex(canonicalRequest),
+        canonicalRequestHash,
     });
     const signatureHex = await signStringToSign(stringToSign, signingKey);
     // 5. Build Authorization Header với số Serial (DECIMAL)
@@ -151,8 +164,7 @@ export async function issueAwsCredentials(input) {
             // Debug logs
             console.error("[aws-rejected] Request details", {
                 status: res.status,
-                response: errorBody,
-                serial: certSerialDec
+                response: errorBody
             });
             throw new InternalError("aws_rejected");
         }
@@ -172,13 +184,70 @@ export async function issueAwsCredentials(input) {
     }
 }
 // ---- helpers ----
+function normalizeCert(raw) {
+    if (raw.includes("BEGIN CERTIFICATE")) {
+        throw new InternalError("pem_not_allowed");
+    }
+    return raw.trim();
+}
 async function sha256Hex(input) {
-    const data = new TextEncoder().encode(input);
+    const data = textEncoder.encode(input);
     const hash = await crypto.subtle.digest("SHA-256", data);
     const bytes = new Uint8Array(hash);
-    return Array.from(bytes)
-        .map((b) => b.toString(16).padStart(2, "0"))
-        .join("");
+    const hex = new Array(bytes.length);
+    for (let i = 0; i < bytes.length; i++) {
+        const h = bytes[i].toString(16);
+        hex[i] = h.length === 1 ? "0" + h : h;
+    }
+    return hex.join("");
+}
+async function getCanonicalRequestHash(canonicalRequest) {
+    if (lastCanonicalRequest === canonicalRequest && lastCanonicalRequestHash) {
+        return lastCanonicalRequestHash;
+    }
+    const hash = await sha256Hex(canonicalRequest);
+    lastCanonicalRequest = canonicalRequest;
+    lastCanonicalRequestHash = hash;
+    return hash;
+}
+async function getPayloadHash(body) {
+    if (lastBody === body && lastPayloadHash) {
+        return lastPayloadHash;
+    }
+    const hash = await sha256Hex(body);
+    lastBody = body;
+    lastPayloadHash = hash;
+    return hash;
+}
+function getCanonicalizedHeaders(baseHeaders) {
+    // build deterministic cache key without JSON.stringify allocation
+    const key = baseHeaders["content-type"] + "|" +
+        baseHeaders["host"] + "|" +
+        baseHeaders["x-amz-date"] + "|" +
+        baseHeaders["x-amz-x509"];
+    if (lastBaseHeadersKey === key && lastCanonicalHeaders && lastSignedHeaders) {
+        return { canonicalHeaders: lastCanonicalHeaders, signedHeaders: lastSignedHeaders };
+    }
+    const { canonicalHeaders, signedHeaders } = canonicalizeHeaders(baseHeaders);
+    lastBaseHeadersKey = key;
+    lastCanonicalHeaders = canonicalHeaders;
+    lastSignedHeaders = signedHeaders;
+    return { canonicalHeaders, signedHeaders };
+}
+function getCanonicalRequest(input) {
+    const key = input.method + "|" +
+        input.canonicalUri + "|" +
+        input.query + "|" +
+        input.canonicalHeaders + "|" +
+        input.signedHeaders + "|" +
+        input.payloadHash;
+    if (lastCanonicalRequestKey === key && lastCanonicalRequest) {
+        return lastCanonicalRequest;
+    }
+    const req = buildCanonicalRequest(input);
+    lastCanonicalRequestKey = key;
+    lastCanonicalRequest = req;
+    return req;
 }
 function base64ToArrayBuffer(base64) {
     const binary = atob(base64);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vizamodo/aws-sts-core",
-  "version": "0.2.19",
+  "version": "0.2.34",
   "description": "Pure AWS STS + SigV4 (X509 Roles Anywhere) core logic",
   "type": "module",
   "main": "dist/index.js",
@@ -16,7 +16,8 @@
     "clean": "rm -rf dist",
     "prepublishOnly": "npm run build",
     "dev": "ts-node bin/viza.ts",
-    "release:prod": "rm -rf dist && npx npm-check-updates -u && npm install && git add package.json package-lock.json && git commit -m 'chore(deps): auto update dependencies before release' || echo 'No changes' && node versioning.js && npm login && npm publish --tag latest --access public && git push"
+    "release:prod": "rm -rf dist && npx npm-check-updates -u && npm install && git add package.json package-lock.json && git commit -m 'chore(deps): auto update dependencies before release' || echo 'No changes' && node versioning.js && npm publish --tag latest --access public && git push",
+    "release:full": "rm -rf dist && npx npm-check-updates -u && npm install && git add package.json package-lock.json && git commit -m 'chore(deps): auto update dependencies before release' || echo 'No changes' && node versioning.js && npm login && npm publish --tag latest --access public && git push"
   },
   "devDependencies": {
     "typescript": "^5.9.3"